Skip to content

python_packages query is not making use of new user directory scanning #26423

@ksykulev

Description

@ksykulev

Fleet version: 4.64

Related to #24805


💥  Actual behavior

The current software inventory query issued by fleet is

SELECT
  name AS name,
  version AS version,
  '' AS bundle_identifier,
  '' AS extension_id,
  '' AS browser,
  'python_packages' AS source,
  '' AS vendor,
  0 AS last_opened_at,
  path AS installed_path
FROM python_packages

It does not use the new functionality released in osquery 5.16
Specifically osquery/osquery#8504

🧑‍💻  Steps to reproduce

osquery less than 5.16.0 (this is the current version in fleet)

  1. Install python via pyenv.
  2. Use pip to install a python package ($ pip install numpy)
  3. Add the host to fleet
  4. Refetch host vitals
  5. Open up software inventory and see that there are results for the host (ensure that there is no error running the osquery software queries). However, numpy should not be included.

osquery greater than or equal to 5.16.0

  1. Install python via pyenv.
  2. Use pip to install a python package ($ pip install numpy)
  3. Add the host to fleet
    1. Refetch host vitals
  4. Open up software inventory and see that there are results for the host, see that numpy is included.

🛠️ To fix

Change the query to

SELECT
  name AS name,
  version AS version,
  '' AS bundle_identifier,
  '' AS extension_id,
  '' AS browser,
  'python_packages' AS source,
  '' AS vendor,
  0 AS last_opened_at,
  path AS installed_path
FROM cached_users CROSS JOIN python_packages USING (uid)

This query uses a new feature that was not available in previous version of osquery. Ensure that the query can automatically detect which version to use such that it does not break.

Metadata

Metadata

Assignees

Labels

#g-softwareSoftware product group:releaseReady to write code. Scheduled in a release. See "Making changes" in handbook.bugSomething isn't working as documented~backendBackend-related issue.~released bugThis bug was found in a stable release.

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions